# Faking Basic Auth **URL:** \ **Category:** Rails\ **Created:** [February 9, 2007, 2:35am UTC](https://www.ruby-forum.com/t/faking-basic-auth/84994 "2007-02-09T02:35:33Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![zakifataya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/c89c15/32.png) [@zakifataya](https://www.ruby-forum.com/u/zakifataya)\ **Post date:** [February 9, 2007, 2:35am UTC](https://www.ruby-forum.com/t/faking-basic-auth/84994/1 "2007-02-09T02:35:33Z")
I have a Rails app that shows catalogs of images. The images are generated by a CGI that requires REMOTE\_USER to be set. This is accomplished by protecting the CGI folder with Basic Auth. I can see how to implement Basic Auth in Rails, and this looks like it will then allow Rails to reference the images (as long as my authenticated Rails user matches a realm user). The problem is, I’d like the option of emailing direct links to some images, so that the recipient can click on a url to view a single image (this can be inside a Rails template). In this case, I don’t want the user to be challenged - some component of the url can be decoded to determine who the user is. Is there any way to “silently” set the authentication credentials, or set the REMOTE\_USER on the fly so the CGI sees it and executes? ---
**Author:** ![zakifataya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/c89c15/32.png) [@zakifataya](https://www.ruby-forum.com/u/zakifataya)\ **Post date:** [February 9, 2007, 5:08am UTC](https://www.ruby-forum.com/t/faking-basic-auth/84994/2 "2007-02-09T05:08:48Z")
Brian A. wrote: > Is there any way to “silently” set the authentication credentials, or > set the REMOTE\_USER on the fly so the CGI sees it and executes? Write a controller that uses send\_file in response to one of these special URLs. Put a key in the URL that you retire after some time limit, such as 24 hours. Then remove the login requirements for that controller. – Phlip [Redirecting...](http://www.greencheese.us/ZeekLand) ← NOT a blog!!! ---
**Author:** ![zakifataya](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/c89c15/32.png) [@zakifataya](https://www.ruby-forum.com/u/zakifataya)\ **Post date:** [February 9, 2007, 3:00am UTC](https://www.ruby-forum.com/t/faking-basic-auth/84994/3 "2007-02-09T03:00:40Z")
On 2/8/07, Brian A. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > recipient can click on a url to view a single image (this can be inside > a Rails template). In this case, I don’t want the user to be challenged > > - some component of the url can be decoded to determine who the user is. > > Is there any way to “silently” set the authentication credentials, or > set the REMOTE\_USER on the fly so the CGI sees it and executes? Yes, to preset basic authentication you can do this as part of the url like so [http://user:removed\_email\_address@domain.invalid/foo/bar](http://user:removed_email_address@domain.invalid/foo/bar) The user and password will be used for basic authentication. This is part of the http spec, so it is supported by all major browsers. So you can email out links with the authentication in it and they should work as if they had authenticated manually. You can also use these as links bookmarks (of course they are not securely stored since anyone can click on them to use). Blessings, Jeff – Jeff B., MasterView core team Inspired Horizons Ruby on Rails Training and Consultancy Next Ruby on Rails plus JRuby workshop Feb 22-24 St. Louis, MO [http://inspiredhorizons.com/training/rails/index.html](http://inspiredhorizons.com/training/rails/index.html) Limited seating, register now!